Clarify authoring reference ordering

[iperev]

Summary

• Explain the existing strictly sorted, unique authoringRefs.refId rule in lazy CLI help. Keep each full reference with its identity.
• Exercise one and two references in both authoring modes through the actual CLI and materialization planner. Preserve exact provenance fields and candidate-only authority; reject unsorted and duplicate references before report output.
• Prepare compatible 0.14.7 with updated source-bound digests, generated contract records and an independent exact release-note oracle. Accepted input semantics and report identities are unchanged.

Verification

• Full npm run check passed on 722b3d00364d7c1fe95abbc431c9c288c75f4bd0, with a clean final worktree, including 315 browser cases.
• The new help assertion failed against the previous help text before the correction.
• Four isolated digest/kind/path/nonClaims projection mutants passed the original two-reference fixture and fail the repaired fixture at the intended exact-equality assertion. The genuine implementation passes.
• Independent source and release reviews completed. Two fixture-local P3 observations had one test-only repair; no production defect was inferred from them.
• Structured comparison confirms that the public contract changes only its two affected native-source digests; the generated ABI fingerprint is refreshed.

Boundaries

This fixes a repeated instruction gap observed in two mixed-runtime CLI-only trials. It does not claim exhaustive mutation adequacy, completion of the remaining adoption/codec program, publication, consumer approval or production readiness. Static review records retain their host-isolation and open-world limitations. Provider checks and publication are verified separately.